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DETAILED ACTION 

1 . The Amendment, and remarks therein, received on 8/01/2005 have been entered 
and carefully considered. 

2. The Amendment introduces a new limitation into the originally sole independent 
claims 1, 9 and 17. The newly introduced limitation has required a new search and 
consideration of the pending claims. The new search has resulted in newly 
discovered prior art. New grounds of rejection based on the newly discovered prior 
art follow below. 

3. The text of those sections of Title 35, U.S. Code not included in this action can be 
found in a prior office action. 

Response to Amendment 

4. Applicant suggests that the use of references cited in the previous Office Action 
rejection was confusing. 

5. In the response in this Office Action the examiner makes a special attempt to clearly 
identify the references used. However, the examiner reminds applicant that certain 
references e.g. Stallings are used simply as an example of facts that are old and 
well-known practice and not necessarily used as the rejection art. 

6. Applicant's arguments have been carefully considered but they were not found 
persuasive. 

7. On pages 21-22 of the remarks dated 8/01/05 applicant argues the previous Office 
Action rejection based on the newly introduced limitations: "interfaces permitting an 
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access to said data file during said predetermined permission time" and "interfaces 
... to be expired after a predetermined permission time". 

8. The first (cited above) limitation required an additional search and is addressed in 
this Office Action. 

9. As the second (cited above) limitation the examiner disagrees that references 
provided in support of the fact that it would have been obvious to one of ordinary skill 
in the art at the time of applicant's invention to expire interfaces after a 
predetermined permission time. The Stallings reference has been provided to 
indicate an old and well known fact that any permissions should be associated with 
time. Stallings teaches that an attacker may take control of an object that allows 
access and associating this object with time (a timestamp) aims to minimize the 
duration of this threat (Stallings, pg. 328). 

The examiner points out that applicant's invention also deals with objects allowing 
access ("interfaces permitting an access...") and as a result the reference even 
though illustrative is very much relevant to the case. 

Stallings has been used as an example but applicant should appreciate various 
every day examples in use at the time of Applicant's invention, wherein access 
expired after a predetermined time, e.g. cookies (in electronic transactions such as 
web mail). 

10. On page 22 of the remarks dated 8/01/05, applicant refers to claim 6 and argues that 
the art of record does not disclose "an information file for storing a plurality of 
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functions of a remote method invocation protocol and a plurality of flags for defining 
which manager is permitted to use which function". 

1 1 .The examiner refers applicant to § 40 in the previous Office Action. 

12. Claims 1-20 have been examined. 

Claim Rejections - 35 USC §112 

The following is a quotation of the first paragraph of 35 U.S.C. 1 1 2: 

The specification shall contain a written description of the invention, and of the manner and process of 
making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the 
art to which it pertains, or with which it is most nearly connected, to make and use the same and shall 
set forth the best mode contemplated by the inventor of carrying out his invention. 

13. Claims 6-7 are rejected under 35 U.S.C. 112, first paragraph, as failing to comply 
with the written description requirement. The claim(s) contains subject matter which 
was not described in the specification in such a way as to reasonably convey to one 
skilled in the relevant art that the inventor(s), at the time the application was filed, 
had possession of the claimed invention. 

14. The newly introduced limitation "an information file for storing a plurality of functions 
of a remote method invocation protocol each having permission time for a 
manager ..." does not have support in the specification. 

15. Claim 7 is rejected by virtue of its dependence. 



Claim Rejections - 35 USC § 103 
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1. Claims 1-2, 6, 8-10, 14 and 16-18 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Moshfeghi (U.S. Patent No. 6476833) in view of each Howard et 
al. (U.S. Patent No. 6353886) and Minasi (Mark Minasi, "Mastering Windows NT 
Server 4, 6th edition, 1999, ISBN: 0782124453). 

2. As per claim 9 Moshfeghi teaches a user entering authentication information (a user 
ID and a password). The application then authenticates the user and the user's 
access rights for example by invoking authentication methods on tier 2 servers 
which access information in the user directory and compare it to entered 
authenticating information. After authentication, user profile records are loaded to 
the memory of the end-user device. The application then displays a window 
configured according to directions in the loaded user profile records and the user 
commences application interaction with the application specific controls (Moshfeghi, 
col. 12 line 58 - col. 13 line 15). 

This reads on a step of authentication wherein a second manager ID and a second 
password received from a manager accesses a data file, in accordance with a first 
ID and a first password stored beforehand; a step of creating interfaces for the 
manager if the authenticating of the second manger ID and the second password 
succeeds. 

3. Moshfeghi does not teach that permitting access during a predetermined permission 
time. 
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Howard et al. and Minasi teach permitting access during a predetermined 
permission time (Howard et al., U.S. Patent No. 6353886, col. 6 lines 15-16; Minasi 
pg. 355-356). 

It would have been obvious to one of ordinary skill in the art at the time of applicant's 
invention to permit access during a predetermined permission time as taught by 
Howard et al. or Minasi. One of ordinary skill in the art would have been motivated to 
perform such a modification in order to specify the days and/or hours during which a 
particular manager can access resources (data files). 

4. As per claims 1 and 1 7 Moshfeghi, Howard et al. and Minasi do not explicitly teach 
the interfaces to be expired after a predetermined time. However, the importance of 
revoking access after some predetermined time is well known in the art (e.g. on pg. 
328 Stallings teaches access revocation after a predetermined time and provides a 
motivation for implementing such a measure). 

It would have been obvious to one of ordinary skill in the art at the time of applicant's 
invention to expire the interfaces after a predetermined time. One of ordinary skill in 
the art would have been motivated to perform such a modification in order to 
increase the system's security. 

5. As per claims 6 and 14 Moshfeghi teaches that information exchange utilizes RMI 
(col. 5 lines 21-31). Furthermore Moshfeghi teaches that requests from the client 
applications to the business-server objects are intercepted by access decision 
facility, which checks whether the requesting user, who has the particular access 
control information stored in the user directory, is authorized to access the 
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information requested in view of the access control policies stored in the access 
control policy database (col. 8 lines 58-65). 

This reads on an information file for storing a plurality of functions of a RMI and a 
plurality of flags for defining which manager is permitted to use which function. 

6. As per claims 2, 10 and 18 Moshfeghi teaches logoff functionality (col. 13 lines 36- 
37). 

7. As per claims 8 and 16 Java Virtual Machine is the crucial piece of every Java 
installation that allows Java programs (applets) to run on computer platforms. 

8. Claims 3-4, 11 -12 and 19-20 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Moshfeghi (U.S. Patent No. 6476833) in view of each Howard et 
al. (U.S. Patent No. 6353886) and Minasi (Mark Minasi, "Mastering Windows NT 
Server 4, 6th edition, 1999, ISBN: 0782124453) and further in view of Stein (Lincoln 
D. Stein, "Web Security, a step-by -step reference guide", 1998, ISBN: 
0201634899). 

9. Moshfeghi, Howard et al. and Minasi teach the manager accessing the interfaces 
received from the management object as discussed above. 

1 0. Moshfeghi, Howard et al. and Minasi do not teach that the management object 
transmits a corresponding cipher key to the manager authenticated by the second 
manager ID and the second password, and the authenticated manager accesses the 
interfaces by using the cipher key. 

Stein teaches a cipher key exchange to secure a session and communication parties 
communicating in encrypted mode (Stein, Fig. 3.2 and pg. 41-42). 
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It would have been obvious to one of ordinary skill in the art at the time of applicant's 
invention to configure the management object to transmit a corresponding cipher key 
to the manager certified by the second manager ID and the second password 
(exchange cipher keys), and the manager accesses the interfaces by using the 
cipher key (switch into encrypted mode) as taught by Stein. One of ordinary skill in 
the art would have been motivated to perform such a modification in order to ensure 
data confidentiality. 

1 1 . Limitations of claims 4, 12 and 20 are implicit. A storage management should be 
able to handle many requests. 

12. Claims 5 and 13 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Moshfeghi (U. S. Patent No. 6476833) in view of each Howard et al. (U. S. Patent No. 
6353886) and Minasi (Mark Minasi, "Mastering Windows NT Server 4, 6th edition, 
1999, ISBN: 0782124453) and further in view of Ludwig et al. (U.S. Pub. 
20020198829). 

13. Moshfeghi, Howard et al. and Minasi teach creating interfaces by the management 
object by permitting an access to files as discussed above. 

Moshfeghi, Howard et al. and Minasi do not teach not creating the interfaces if a 
non-use period from the most recent log-out of the manager exceeds a 
predetermined period when the second manager ID and the second password are 
authenticated. 
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Ludwig et al. discusses different security measures including password 
authentication and suggests disabling accounts after a predetermined time of 
inactivity (Ludwig et al. [51]). 

It would have been obvious to one of ordinary skill in the art at the time of applicant's 
invention to disable accounts after a predetermined time of inactivity as taught by 
Ludwig et al. One of ordinary skill in the art would have been motivated to perform 
such a modification in order to make sure that unused accounts are inactive. 
Disabling accounts after a predetermined time of inactivity would result in preventing 
the creation of interfaces if a non-use period from most recent log-out of the 
manager exceeds a predetermined period when the second manager ID and the 
second password are authenticated. 

14. Claims 7 and 15 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Moshfeghi (U.S. Patent No. 6476833) in view of each Howard et al. (U.S. Patent No. 
6353886) and Minasi (Mark Minasi, "Mastering Windows NT Server 4, 6th edition, 
1999, ISBN: 0782124453) and further in view of Cabrera era/. (U.S. Patent No. 
6029160). 

1 5. Moshfeghi, Howard et al. and Minasi teach a system as discussed above. 

16. Moshfeghi, Howard et al. and Minasi do not teach implementing a flag for 
temporarily stopping the use of the created interfaces in response to a maintenance 
request. 

Cabrera et al. teach implementing a flag for temporarily stopping the use of objects 
in response to maintenance (Cabrera et al. col. 6 lines 39-43). 
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It would have been obvious to one of ordinary skill in the art at the time of applicant's 
invention to implement a flag for temporarily stopping the use of the created 
interfaces in response to a maintenance request as taught by Cabrera et al. One of 
ordinary skill in the art would have been motivated to perform such a modification in 
order to prevent any undesirable effects of accessing objects under maintenance. 

17. Claims 1-2, 8-10, and 16-18 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Harter et al. (U.S. Patent No. 6212564) in view of each Howard et 
al. (U.S. Patent No. 6353886) and Minasi (Mark Minasi, "Mastering Windows NT 
Server 4, 6th edition, 1999, ISBN: 0782124453). 

18. As per claim 9 Harter et al. teach a client server environment (Abstract and Fig. 5) 
wherein a servlet running on the server receives the request for the applet launcher 
page based on the user identifier, password and device type. The servlet validates 
the user identifier and password and if they are valid the servlet generates or selects 
the applet launcher HTML page, which is optimal for the requested device. The 
servlet then returns the applet launcher page to the client (Harter et al., Fig. 2 and 
col. 4 lines 14-22). 

This reads on a step of authentication a second manager ID and a second password 
received from a manager accessing to a data file, in accordance with a first ID and a 
first password stored beforehand and a step of creating interfaces for the manager if 
the authentication of the second manager ID and the second password succeeds. 

19. Harter et al. do not teach permitting access during a predetermined permission time. 
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Howard et ai and Minasi teach permitting access during a predetermine permission 
time (Howard etai, U.S. Patent No. 6353886, col. 6 lines 15-16] Minasi pg. 355- 
356). 

It would have been obvious to one of ordinary skill in the art at the time of applicant's 
invention to permit access during a predetermined permission time as taught by 
Howard et ai. or Minasi. One of ordinary skill in the art would have been motivated to 
perform such a modification in order to specify the days and/or hours during which a 
particular manager can access resources (data files). 

20. As per claims 1 and 1 7 Harter et ai, Howard et ai and Minasi do not explicitly teach 
the interfaces to be expired after a predetermined time. However, the importance of 
revoking access after some predetermined time is well known in the art. (For 
example, on pg. 328 Stallings discloses access revocation after a predetermined 
time and provides a motivation for implementing such a measure). 

It would have been obvious to one of ordinary skill in the art at the time of applicant's 
invention to expire the interfaces after a predetermined time. One of ordinary skill in 
the art would have been motivated to perform such a modification in order to 
increase system's security. 

21 . As per claims 2, 1 0 and 1 8 Harter et ai, Howard et ai and Minasi do not explicitly 
teach the interfaces to be expired after a received log-out. 

Official Notice is taken that it is old and well-known practice to expire (the access) 
interfaces after a log-out has been received (e.g. Microsoft Windows NT or Web 
session log-out finishes the session). One of ordinary skill in the art at the time of 
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applicant's invention would expire interfaces after a log-out has been received in 
order to prevent any potential attacks or an unauthorized access. 

22. Col. 3 line 52 - col. 4 line 1 3 in Harteret al. reads on the limitations of claims 8 and 
16. 

23. Claims 3-4, 11-12 and 19-20 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Harter et al. (U.S. Patent No. 6212564) in view of each Howard et 
al. (U.S. Patent No. 6353886) and Minasi (Mark Minasi, "Mastering Windows NT 
Server 4, 6th edition, 1999, ISBN: 0782124453) and further in view of Stein (Lincoln 
D. Stein, "Web Security, a step-by -step reference guide", 1998, ISBN: 
0201634899). 

24. Harter et al., Howard et al. and Minasi teach the manager accessing the interfaces 
received from the management object as discussed above. 

25. Harter et al., Howard et al. and Minasi do not teach that the management object 
transmits a corresponding cipher key to the manager authenticated by the second 
manager ID and the second password, and the authenticated manager accesses the 
interfaces by using the cipher key. 

Stein teaches a cipher key exchange to secure a session and communication parties 
communicating in encrypted mode (Stein, Fig. 3.2 and pg. 41-42). It would have 
been obvious to one of ordinary skill in the art at the time of applicant's invention to 
configure the management object to transmit a corresponding cipher key to the 
manager certified by the second manager ID and the second password (exchange 
cipher keys), and the manager accesses the interfaces by using the cipher key 
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(switch into encrypted mode) as taught by Stein. One of ordinary skill in the art 
would have been motivated to perform such a modification in order to ensure data 
confidentiality. 

26. Limitations of claims 4, 12 and 20 are implicit. A storage management would have 
been used to handle many requests. 

27. Claims 5 and 13 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Harter et al. (U.S. Patent No. 6212564) in view of each Howard et at. (U.S. Patent 
No. 6353886) and Minasi (Mark Minasi, "Mastering Windows NT Server 4, 6th 
edition, 1999, ISBN: 0782124453) and further in view of Ludwig et al. (U.S. Pub. 
20020198829). 

28. Harter et al., Howard et al. and Minasi teach creating interfaces by the management 
object by permitting an access to files as discussed above. 

Harter et al., Howard et al. and Minasi do not teach not creating the interfaces if a 
non-use period from the most recent log-out of the manager exceeds a 
predetermined period when the second manager ID and the second password are 
authenticated. 

Ludwig et al. discusses different security measures including password 
authentication and suggests disabling accounts after a predetermined time of 
inactivity (Ludwig et al. [51]). 

It would have been obvious to one of ordinary skill in the art at the time of applicant's 
invention to disable accounts after a predetermined time of inactivity as taught by 
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Ludwig et al. One of ordinary skill in the art would have been motivated to perform 
such a modification in order to make sure that unused accounts are inactive. 
Disabling accounts after a predetermined time of inactivity would result in preventing 
the creation of interfaces if a non-use period from most recent log-out of the 
manager exceeds a predetermined period when the second manager ID and the 
second password are authenticated. 

29. Claims 1-2, 8-10, and 16-18 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Huang (U.S. Patent No. 6192361) in view of each of Howard et al. 
(U.S. Patent No. 6353886) and Minasi (Mark Minasi, "Mastering Windows NT 
Server 4, 6th edition, 1999, ISBN: 0782124453). 

30. As per claim 9 Huang teaches steps of a browser on a remote computer accessing a 
remote server, the remote server providing the remote computer with java applet 
that is used to communicate ID and password to the system manager; system 
security manager verifying the user ID and password against a database of IDs and 
passwords, and if the ID and password are valid GUI Launcher is launched (Huang, 
Fig. 2 and col. 7 lines 9-24). 

This reads on a step of authentication a second manager ID and a second password 
received from a manager accessing a data file, in accordance with a first ID and a 
first password stored beforehand and a step of creating interfaces for the manager if 
the authenticating of the second manager ID and the second password succeeds. 
Furthermore Huang teaches System Management Interface (56) and Servers (60), 
in conjunction with the GUI Launcher (8) that permits users to access and 
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communicate with the system (230) (Huang, Fig. 1 and col. 8 line 34- col. 9 line 6), 
which reads on said interfaces permitting access by the manager. 

31. Huang does not teach permitting access during a predetermined permission time. 
Howard et al. and Minasi teach permitting access during a predetermined 
permission time (Howard et al., U.S. Patent No. 6353886, col. 6 lines 15-16; Minasi 
pg. 355-356). 

It would have been obvious to one of ordinary skill in the art at the time of applicant's 
invention to permit access during a predetermined permission time as taught by 
Howard et al. or Minasi. One of ordinary skill in the art would have been motivated to 
perform such a modification in order to specify the days and/or hours during which a 
particular manager can access resources (data files). 

32. As per claims 1-2, 10 and 17-18 Huang teaches that the system is used by multiple 
users (Huang, Abstract, col. 2 lines 38-42, col. 6 liens 13-15, etc.), and that when the 
remote computer terminates the logon session the remote computer does not retain 
java applet (Huang, col. 7 lines 59-65) and that interfaces expire after a 
predetermined time (Huang, col. 15 lines 43). 

33. As per claims 8 and 16 Java Virtual Machine is the crucial piece of every Java 
installation that allows Java programs (applets) to run on computer platforms. 

34. Claims 3-4, 11-12 and 19-20 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Huang (U.S. Patent No. 6192361) in view of each Howard et al. 
(U.S. Patent No. 6353886) and Minasi (Mark Minasi, "Mastering Windows NT 
Server 4, 6th edition, 1999, ISBN: 0782124453) and further in view of Stein (Lincoln 



Application/Control Number: 10/021,550 Page 16 

Art Unit: 2134 

D. Stein, "Web Security, a step-by -step reference guide", 1998, ISBN: 
0201634899). 

35. Huang, Howard et al. and Minasi teach the manager accessing the interfaces 
received from the management object as discussed above. 

36. Huang, Howard et al. and Minasi do not teach that the management object transmits 
a corresponding cipher key to the manager authenticated by the second manager ID 
and the second password, and the authenticated manager accesses the interfaces 
by using the cipher key. 

Stein teaches a cipher key exchange to secure a session and communication parties 
communicating in encrypted mode (Stein, Fig. 3.2 and pg. 41-42). 
It would have been obvious to one of ordinary skill in the art at the time of applicant's 
invention to configure the management object to transmit a corresponding cipher key 
to the manager certified by the second manager ID and the second password 
(exchange cipher keys), and the manager accesses the interfaces by using the 
cipher key (switch into encrypted mode) as taught by Stein. One of ordinary skill in 
the art would have been motivated to perform such a modification in order to ensure 
data confidentiality. 

37. The limitations of claims 4, 12 and 20 are implicit. A storage management should be 
able to handle many requests. 

38. Claims 5 and 13 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Huang (U.S. Patent No. 6192361) in view of each Howard et al. (U.S. Patent No. 
6353886) and Minasi (Mark Minasi, "Mastering Windows NT Server 4, 6th edition, 
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1999, ISBN: 0782124453) and further in view of Ludwig et a/. (U.S. Pub. 
20020198829). 

39. Huang, Howard et al. and Minasi teach creating interfaces by the management 
object permitting an access to files as discussed above. 

40. Huang, Howard et al. and Minasi do not teach not preventing the creation of 
interfaces if a non-use period from the most recent log-out of the manager exceeds 
a predetermined period when the second manager ID and the second password are 
certified. 

Ludwig et al. discusses different security measures including password 
authentication and suggests disabling accounts after a predetermined time of 
inactivity (Ludwig et al. [51]). 

It would have been obvious to one of ordinary skill in the art at the time of applicant's 
invention to disable accounts after a predetermined time of inactivity as taught by 
Ludwig et al. One of ordinary skill in the art would have been motivated to perform 
such a modification in order to make sure that unused accounts are inactive. 
Disabling accounts after a predetermined time of inactivity would result in preventing 
the creation of interfaces if a non-use period from most recent log-out of the 
manager exceeds a predetermined period when the second manager ID and the 
second password are authenticated. 

Conclusion 

Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL See MPEP § 
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706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 

1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Peter Poltorak whose telephone number is (571 )272- 
3840. The examiner can normally be reached Monday through Thursday from 9:00 
a.m. to 4:00 p.m. and alternate Fridays from 9:00 a.m. to 3:30 p.m. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gregory Morse can be reached on (571 ) 272-3838. The fax phone number 
for the organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 



Application/Control Number: 10/021,550 Page 19 

Art Unit: 2134 

you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at (866) 217-9197 (toll-free). 




; Signature 
Date 
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